Sap Se

Sap Ag

Michael Engler

Wolfgang Janzen

Kathrin Nos

Martijn De Boer

Peter Eberlein

Matthias Vogel

Bjoern Friedmann

Stephan Zlatarev

Klaus Kiefer

Uwe Steigmann

A security configuration file is received from a first application, the security configuration file including information of an authority. The first application assigns the authority to a second application to enable the second application to trigger jobs at the first application, and the second application provides shared services to a plurality of applications including the first application. A query is received from the second application and in response the authority is sent to the second application. A request for a token is received from the second application, the request including the authority. A token including the authority is sent to the second application. The second application sends the token to the first application when the second application triggers jobs at the first application.

Secure calls between applications

Metadata describing access control capabilities of a database technology resource is received from an access control system. Access restrictions for accessing data of the database resource by users of an application that have a role are received from an application developer. A role maintenance user interface is generated, using the metadata, for assigning the role to users of the application. Attribute values for creating an instance of the role for a user are received, using the role maintenance user interface. The instance of the role is created for the user based on the received attribute values and the access restrictions. A request from the application for the user to access the database resource is received by the access control system when the user is logged into the application. The access restrictions are applied by the access control system in the database resource when the database resource is accessed.

Using domains for flexible data access in heterogeneous system landscapes

The present disclosure describes methods, systems, and computer program products for providing a deployment of applications across a distributed network environment. A computer-implemented method comprises: receiving, at a server and from a client device, a first request including an identifier of a configuration file accessible to the server and one or more identifiers for one or more resources operated by a remote resource server, wherein the resources are requested by an application executed on the client device; in response to the request, retrieving, by the server, one or more tokens associated with the requested resources; transmitting, by the server, a second request to the remote resource server, the second request including the tokens and identifying one or more data processing tasks to be performed by the resources for the application; and receiving, by the server and from the remote resource server, result data that was outputted by the resources executing the data processing tasks.

Reusable application configuration with dynamic resource determination

The present description refers to a computer implemented method, computer program product, and computer system for receiving a resource request at a representational state transfer (REST) client from a user, the resource request including a user ID, determining, by the REST client, a key pair including a public key and a corresponding private key that are associated with the user ID, obtaining, by the REST client, a certificate associated with the user ID that is signed by a certificate authority and based on at least the user ID and the public key associated with the user ID, impersonating, by the REST client, the user to a REST server using the certificate and the private key associated with the user ID, and accessing, by the REST client on behalf of the user, using a stateless protocol with the REST server, the requested resource.

User authentication for intermediate representational state transfer (REST) client via certificate authority

In accordance with aspects of the disclosure, a system and methods are provided for managing multi-system security integration by performing state change calls to one or more backend systems by combining a multi-system protection token with a message component for transporting from a user agent to the one or more backend systems for validation by generating an authentication code for proving authenticity of a combined data structure generated by combining a secret cryptographic data key with a portion of the message component and generating a hash code of the combined data structure, generating an arbitrary random number to bind the multi-system protection token to the user agent, and generating the multi-system protection token by combining the authentication code and the arbitrary random number with the message component for transporting from the user agent to the one or more backend systems for validation.

Growing community of inventors

Walldorf, Germany

Michael Engler